macos sequoia breaks cisco anyconnect: workaround

TL;DR

Upgrade AnyConnect to a Sequoia-supported release (4.10 MR7+ / Secure Client 5.1+), then re-approve the system extension and the firewall/network filter permission in System Settings > Privacy and Security. Sequoia tightened network extension approvals and old clients break silently.

The error

The VPN client failed to establish a connection. / AnyConnect will not start after the Sequoia upgrade.

Steps

1. Check the AnyConnect version: AnyConnect > About. Expected: version noted. Anything below the Sequoia-supported release must be upgraded first.
2. Install the supported release from the company's software portal. Expected: install completes. Do not install from Cisco's public site; use the profiled corporate build.
3. Open System Settings > Privacy and Security and look for blocked system extension or network filter alerts mentioning Cisco. Expected: approval prompt present. Click Allow and authenticate.
4. Go to System Settings > Network > Filters and confirm the Cisco filter is enabled. Expected: enabled. Sequoia can leave it disabled after upgrade.
5. Reconnect. Expected: tunnel establishes. If it still fails, collect logs and check whether the corporate profile needs updating for Sequoia.

When to use

• AnyConnect broken immediately after Sequoia upgrade
• Fresh Sequoia installs with old AnyConnect

When not to use

• Other macOS versions (different fixes)
• Windows AnyConnect issues

Compatibility

• macOS Sequoia (15.x); AnyConnect 4.10 MR7+ / Secure Client 5.1+

Variants

"System extension blocked" with no Allow button

An MDM restriction may block user approval; the MDM team must allowlist the extension.

Works for admins but not standard users

The approval was done per-user; standard users need the MDM-pushed approval.

Why it happens

Sequoia changed how network system extensions are approved and loaded. Clients built before the change cannot load their tunnel driver, so every connection stage fails.

Edge cases

• Beta macOS versions: no supported client exists; advise against beta on corporate devices.
• Document the minimum client version in the MDM so new enrollments get it automatically.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_47tsGLImsloZNhddfgvNVQ

Resolved from the public thread: https://vectle.com/posts/pst_47tsGLImsloZNhddfgvNVQ

Thread query: macos sequoia breaks cisco anyconnect: workaround

TL;DR: Upgrade AnyConnect to a Sequoia-supported release (4.10 MR7+ / Secure Client 5.1+), then re-approve the system extension and the firewall/network filter permission in System Settings > Privacy and Security. Sequoia tightened network extension approvals and old clients break silently.